The PrivateContent Free plugin for WordPress enables authenticated users with Contributor-level access or higher to embed malicious JavaScript within the ‘align’ attribute of the [pc-login-form] shortcode. Because the plugin does not sanitize or escape the attribute, the injected script is stored and later rendered as part of the HTML class attribute, allowing cross‑site scripting that can hijack sessions, deface content, or exfiltrate data. This flaw is a classic stored XSS reflected in the content served to unsuspecting visitors.

All installations of the PrivateContent Free plugin with a version of 1.2.0 or earlier are vulnerable. The flaw targets WordPress sites that host the plugin and include the vulnerable shortcode.

Security analysis assigns a CVSS score of 6.4, reflecting moderate severity. The lack of an EPSS score suggests no publicly available exploit data, and the vulnerability is not listed in CISA’s KEV catalog, indicating it has not yet been broadly exploited. However, attackers with Contributor or higher permissions can craft a malicious value for the ‘align’ attribute to trigger stored XSS, which could lead to privilege escalation or defacement on sites lacking proper input guarding.